EUROPEAN COMMISSION

PROTECTION OF YOUR PERSONAL DATA

This privacy statement provides information about

the processing and the protection of your personal data.

Processing operation: AMR One Health Network meeting

Data Controller: European Commission, DG SANTE, Unit G.4

1. Introduction

The European Commission is committed to protect your personal data and to respect your
privacy. The Commission collects and further processes personal data pursuant to Regulation
(EU) 2018/1725 of the European Parliament and of the Council on the protection of natural
persons with regard to the processing of personal data by the Union institutions, bodies, offices
and agencies and on the free movement of such data.

This privacy statement explains the reason for the processing of your personal data in the
context of the AMR One Health Network meetings. It explains the way we collect, handle and
ensure protection of all personal data provided, how that information is used and what rights
you have in relation to your personal data. It also specifies the contact details of the responsible
Data Controller with whom you may exercise your rights, the Data Protection Officer and the
European Data Protection Supervisor.

The information in relation to processing operation of the AMR One Health Network meetings,
undertaken by DG SANTE, Unit G.4 of the European Commission, is presented below.

2. Why and how do we process your personal data?

Purpose of the processing operation: DG SANTE, Unit G.4 collects and further processes your
personal data to provide you with information about the meeting (before, during and after) and
to process your application for participation in that meeting.

3. On what legal ground(s) do we process your personal data?

The processing operations on personal data, linked to the organisation, management, follow-up
and promotion of the meeting are necessary for the management and functioning of the
Commission, as mandated by the Treaties. Those provisions are in particular, Article 11 of the
Treaty on European Union and Articles 15, 114, 168 and 169 of the Treaty on the Functioning of
the European Union. Consequently, those processing operations are lawful under Article 5(1)(a)
of Regulation (EU) 2018/1725 (processing is necessary for the performance of a task carried out

Commission européenne/Europese Commissie, 1049 Bruxelles/Brussel, BELGIQUE/BELGIË - Tel. +32 22991111

in the public interest or in the exercise of official authority vested in the Union institution or
body).

Your consent is required for the sharing of the eventual documents that you presented under
your name during the meeting.
4. Which personal data do we collect and further process?

The following personal data will be processed:

 contact details (function/title, first name, last name, name of organisation, city, country,
e-mail address, telephone number);

 nationality, passport or identity card number and its date of issue and expiry date may
be collected, so that the data subjects may obtain access to the premises where the
meeting/event is held;

 financial information (such as a payment card number or bank account) may be

collected for the payment of fees of the meeting/event or for possible reimbursements.
5. How long do we keep your personal data?

The Data Controller only keeps your personal data for the time necessary to fulfil the purpose of
collection or further processing.

For each of the categories of personal data that is processed, please find below the retention
details and the reference to the relevant record of processing:

 All personal data related to the organisation and management of the meeting (this
includes the information given during the registration, before, during or after the event)
will be deleted one year after the last action in relation to the AMR One Health Network
meeting;
 Presentations given during the meeting will be deleted five years after the meeting;
 Personal data shared with the Directorate-General for Human Resources and Security of
the European Commission for the participants to gain access to Commission buildings is
kept for six months after the termination of the link between the data subject and the
Commission. More information is available in the Record of Processing DPR-EC-00655
(Commission Physical Access Control System (PACS)).

6. How do we protect and safeguard your personal data?

All personal data in electronic format (e-mails, documents, databases, uploaded batches of
data, etc.) are stored on the servers of the European Commission. All processing operations are
carried out pursuant to Commission Decision (EU, Euratom) 2017/46 of 10 January 2017 on the
security of communication and information systems in the European Commission.

In order to protect your personal data, the Commission has put in place a number of technical
and organisational measures. Technical measures include appropriate actions to address online
security, risk of data loss, alteration of data or unauthorised access, taking into consideration
the risk presented by the processing and the nature of the personal data being processed.
Organisational measures include restricting access to the personal data solely to authorised
persons with a legitimate need to know for the purposes of this processing operation.

7. Who has access to your personal data and to whom is it disclosed?

2
Access to your personal data is provided to the Commission staff responsible for carrying out
this processing operation and to other authorised Commission staff according to the “need to
know” principle. Such staff abide by statutory, and when required, additional confidentiality
agreements.
The presentations given during the meeting will be published on a dedicated web page on
Europa website.

8. What are your rights and how can you exercise them?

You have specific rights as a ‘data subject’ under Chapter III (Articles 14-25) of Regulation (EU)
2018/1725, in particular the right to access, your personal data and to rectify them in case your
personal data are inaccurate or incomplete. Where applicable, you have the right to erase your
personal data, to restrict the processing of your personal data, to object to the processing, and
the right to data portability.

You have the right to object to the processing of your personal data, which is lawfully carried
out pursuant to Article 5(1)(a) of Regulation (EU) 2018/1725 on grounds relating to your
particular situation.

You might have consented to publish your first and last name, affiliation and country of origin in
connection with publication of your presentation. You can withdraw your consent at any time
by notifying the data controller SANTE-CONSULT-G4@EC.EUROPA.EU. The withdrawal of your
consent will not affect the lawfulness of the processing carried out before you have withdrawn
the consent.

You can exercise your rights by contacting the data controller, or in case of conflict the Data
Protection Officer. If necessary, you can also address the European Data Protection Supervisor.
Their contact information is given under Heading 9 below.

Where you wish to exercise your rights in the context of one or several specific processing
operations, please provide their description.

9. Contact information

- The Data Controller

If you would like to exercise your rights under Regulation (EU) 2018/1725, or if you have
comments, questions or concerns, or if you would like to submit a complaint regarding the
collection and use of your personal data, please feel free to contact the Data Controller SANTE-
CONSULT-G4@EC.EUROPA.EU.

- The Data Protection Officer (DPO) of the Commission

You may contact the Data Protection Officer (DATA-PROTECTION-OFFICER@ec.europa.eu) with

regard to issues related to the processing of your personal data under Regulation (EU)
2018/1725.

- The European Data Protection Supervisor (EDPS)

You have the right to have recourse (i.e. you can lodge a complaint) to the European Data
Protection Supervisor (edps@edps.europa.eu) if you consider that your rights under Regulation

3
(EU) 2018/1725 have been infringed as a result of the processing of your personal data by the
data controller.

10. Where to find more detailed information?

The Commission Data Protection Officer (DPO) publishes the register of all processing
operations on personal data by the European Commission, which have been documented and
notified to him. You may access the register via the following link: http://ec.europa.eu/dpo-
register.